Spam Kings

by McWilliams, Brian S

  Nanae Battles over Block Lists

  Although she appreciated the sentiment, Shiksaa wasn't entirely comfortable with being called an anti-spam goddess. She knew that long before she received her first junk email message, several other women had already distinguished themselves as elite anti-spam activists. Among the established luminaries was Kelly Molloy Thompson, a Washington State resident who for several years had been the public face of spam fighting and was quoted widely in press reports on the topic.

  But in the late summer of 2001, during a seismic shift in the world of spammer block lists, Thompson did something that would force Shiksaa and other junk email opponents to rethink Thompson's place in the anti-spam pantheon.

  As early as 1998, with her round face, coiffed hair, and perky smile, Thompson came across more like a kindergarten teacher than an anti-spam fanatic. That made her the perfect spokesperson for the handful of spam busters who decided to picket a Seattle car dealer in May 1998. Led by the 31-year-old Thompson, the protestors stood outside Aurora Nissan on a busy suburban Seattle street. They held up hand-lettered signs to passing motorists, decrying the car dealer's use of a contract spammer to send unsolicited email ads to thousands of Seattle Internet users.

  Thanks to some savvy advance PR work by Thompson, the unusual protest was covered by the national media, which quoted her on the evils of spam, and eventually resulted in a public apology from the dealer. The event also garnered lots of attention for an anti-spam group Thompson helped found earlier that year: the Forum for Responsible and Ethical Email (FREE).

  Thompson's organizing abilities were showcased again in 1999, when FREE picketed Internet multimedia software developer Real Networks. The Seattle company had drawn criticism from anti-spammers for sending email advertisements to anyone who downloaded its media player software. FREE argued that responsible email marketers send their ads only to Internet users who have expressly confirmed their interest in receiving them. After Real Networks stubbornly persisted, the Mail Abuse Prevention System (MAPS) placed the company on its spammer blacklist. When that failed to change Real's practices, Thompson and a dozen or so other protestors staged a protest across the street from Real's headquarters in a downtown Seattle high-rise tower.

  As the anti-spammers were handing out leaflets and displaying their signs ("Spam is theft!") to passersby, a few Real Networks representatives showed up. They invited Thompson and other organizers up to the company's offices and asked Thompson to instruct the other protestors to disperse. Thompson said they'd happily meet with company officials after the picket was over. But until then, the anti-spammers would hold their ground. At the scheduled conclusion of the protest, Thompson and two other antis rode the elevator up to Real's twenty-ninth-floor offices. They ended up spending over three hours trying to educate the firm's marketing executives about why spamming was actually bad for business.

  Thompson's impromptu meeting with Real Networks didn't instantly change the company's business practices. But it did help her land a job the following November with MAPS in Redwood City, California. As associate director, she was responsible for media relations as well as for handling negotiations with companies eager to get off MAPS's Realtime Blackhole List (RBL).

  Soon, Thompson was working sixty-hour weeks, trying to keep both spammers and anti-spammers at bay. She quickly discovered that being on the front lines at an anti-spam protest was nothing like working the phones of a blacklisting organization. Anti-spammers frequently emailed and phoned her to inquire why MAPS was slow to process nominations to the RBL. But her toughest job was informing companies that they were about to be placed on the RBL. Since many major ISPs, including America Online and Microsoft, relied on the RBL to filter their email, blacklisted companies were unable to exchange email with large swaths of the Internet. As a result, many firms facing the blacklist were hostile when Thompson gave them the word.

  On one occasion, when Thompson warned the manager of a company that it was headed for the RBL, he snidely asked how many different fathers her children had. The representative of another firm about to be blacklisted inquired whether she was on welfare. Another time, Thompson informed a California ISP that it would find itself on the RBL if it continued providing service to Bulk ISP Corporation, a spam-support company. When word reached Saied Abdul R. Al-Zalzalah, the head of Bulk ISP Corp, he left an angry message on the MAPS hotline answering machine.

  "You've caused a lot of problems for us now. I have to move the site somewhere else. That's a lot of work for me to do," said Al-Zalzalah. "I think you're a bitch. I'm going to go speak with my lawyer today ... and get your site sued, you and your company, and try to get you fired."[1]

  Al-Zalzalah never succeeded in his threats. But taking verbal abuse remained a regular part of Thompson's workday. Some callers to the hotline even went so far as to threaten to kill Thompson. One day, as she was getting into her car after work, she noticed someone had shot a hole in the windshield.

  Soon, the attacks on MAPS came from high-priced lawyers hired by large Internet firms. In 2000, several companies, including Harris Interactive, a division of the renowned polling firm, filed separate lawsuits against MAPS after being listed on the RBL. In a news report about the Harris lawsuit, the polling company's chief executive accused MAPS of being "a group of self-appointed zealots."

  Rather than circling the wagons around MAPS, Shiksaa and other spam fighters watched the attacks with a sense of detachment. Over the years, they had grown increasingly disillusioned with the service and were often frustrated with what they considered its excessive caution and lack of communication.

  But the erosion of support for MAPS accelerated in October 2000. A discussion had been underway in Nanae about how the block list could improve its effectiveness. In a moment of frustration, MAPS founder and chief executive Paul Vixie crashed the conversation.

  "Fuck Nanae," he wrote in a posting to the newsgroup, and then twisted the knife.

  "I mean, a lot of you are my friends, but...your opinions about what MAPS should be doing are both generally and specifically worthless other than as conversation-starters."

  Nanae participants recoiled, giving Vixie an opportunity to soften his remarks. But instead he dug in: "You may all fight spammers if you wish. MAPS is fighting spam itself."

  The distinction was an important one to many spam opponents who believed that it was detrimental to personalize their battles with spam. But Vixie's proclamation caused a rift among spam fighters.

  Until that point, Shiksaa, like many anti-spammers, still thought of MAPS as a kind of community-based project. Technically, it was a California limited liability corporation that employed over twenty people. But MAPS relied heavily on nominations from the grass roots in building its spammer blacklist. Shiksaa also tremendously admired the dedication of Thompson and other people running the organization, and she had been prepared to contribute generously to the MAPS legal defense fund. But Shiksaa announced that she had put away her checkbook after reading Vixie's comment, as did a number of other anti-spammers on Nanae.

  MAPS nonetheless managed to weather its legal challenges. It was able to convince Harris to drop its lawsuit and switch to a "confirmed opt-in" system, under which Internet users would have to follow two explicit steps before Harris could add them to its mailing list. But the lawsuits also drained MAPS financially, and when the dot-com economy started to tank in late 2000, MAPS suffered as well. In response, the non-profit made a big announcement in mid-July of 2001. The block list service said it was discontinuing its practice of voluntary subscriptions and instead would require all large users to pay (up to $10,000 annually) for access to the RBL and other MAPS services.

  "MAPS' purpose is to stop spam on the Internet. That purpose can only be achieved as long as MAPS can maintain itself as a corporation...MAPS can simply no longer afford to foot the bill for the bulk of the Internet community," said Margie Arbon, MAPS business development manager, in a posting to Nanae about the policy changes. G
oing forward, MAPS would allow free access to its data only "under limited circumstances" she said.[2]

  Despite the stress, Kelly Thompson loved her stint at MAPS; and she loved making a difference in the spam fight. But two weeks after the big subscription announcement, Thompson posted a note of her own on Nanae: she had resigned her position and was looking for work.

  Thompson didn't explain why she was leaving, but it was obvious to Shiksaa. MAPS had become increasingly impotent over the years, and its switch to a fee-based system was just the final death knell. In making the decision to go purely commercial, MAPS would lose the goodwill of many volunteers such as Shiksaa, who for years had felt that MAPS treated them with indifference.

  The MAPS announcement set in motion other important changes in the anti-spamming world. In August, a new spam blacklist quietly appeared on the Internet. In many ways, it was the antithesis of MAPS. Calling itself the Spam Prevention Early Warning System, or Spews, the new blacklist could be downloaded for free by anyone. The operators of Spews were anonymous. (The registration record for the site, Spews.org, listed an address in the Russian Federation of Irkutsk, but most people on Nanae assumed that was a joke.)

  Unlike MAPS, Spews was not interested in receiving nominations to its block list. "Think of it as one group's Consumer Reports review of portions of the billions of Internet addresses," said a notice at the site. In fact, there was no way to communicate directly with Spews. The operators simply instructed individuals to leave messages for them on Nanae.

  Perhaps the biggest difference between Spews and MAPS was the ruthlessness with which Spews attacked spam. MAPS usually tried to educate companies about how to avoid being blacklisted, whereas the operators of Spews appeared to have a "shoot first, ask questions later" mentality about hard-core spammers. They never shied away from causing collateral damage and sometimes placed all of an Internet service provider's network addresses on the Spews list, even if spammers were using only a small portion.

  Yet the renegade new service continued to attract supporters, with significant numbers of mail server operators using the block list to protect their users from spam. With its higher public profile, Spews became the subject of intense speculation about who was running the show.

  One Nanae reader noted that the design of the Spews site was strikingly similar to one used by Xoasis.com, a free web-hosting service run by a Seattle ISP. A Nanae regular named Gary reported receiving a phone call from someone representing himself as one of the principals of Spews. The caller had revealed that Spews was run by seven people, each of whom was a system administrator at a large company. But the caller hadn't revealed his name or those of the other Spews principals.

  "I suspect any attempt to back track Spews is going to run into brick walls, dead ends, land mines, booby traps...I suspect that a LOT of thought went into this," wrote Gary.

  While many anti-spammers admired Spews for its boldness, Thompson found the blacklist's secrecy offensive.

  "I signed my name to every single thing I did at MAPS. I took the phone calls, I answered the email, and I didn't hide," she wrote in a note to Nanae. "People know who I am, and they can decide whether to trust me or not. I owned my work. If they don't have the guts to own their work, then I don't care to consider their opinion."

  Thompson also resented Spews's decision to use Nanae as its support forum. Why should the newsgroup have to be polluted with irate postings from companies blacklisted by Spews?

  Among those who defended Spews was Steve Linford, operator of Spamhaus.org. Linford said he was saddened by the way some anti-spammers had greeted the new blacklist. He noted that since Spews went live, it had already caused several recalcitrant ISPs to give the boot to longtime junk emailers on their networks. Many of those same spammers had also been listed in the Spamhaus Register of Known Spam Operations (Rokso), which had grown from just twenty-four firms in 2000 to over sixty by August of 2001.

  "There are suddenly a lot of homeless spammers" thanks to Spews, noted Linford. Then, in a comment directed at Thompson, Linford defended the decision by Spews's operators to remain anonymous. As he saw it, Spews was hoping to avoid the same fate as MAPS.

  "The MAPS ex-staffers here know better than anyone how many people contacted you every day asking and demanding replies, wanting every ISP black holed now, sending you spam after spam, carbon-copying you on everything, not to mention the amount of spammers calling you trying to wangle off your list," wrote Linford.

  As he justified why Spews operated as it did, Linford might just as well have been describing the pressures he felt as the not-anonymous operator of Spamhaus.

  "They don't want their personal details, addresses and phone numbers known to every spammer and every lawyer in town. They're in the front line, right in the thick of it, finding out who's making the connection with whom, which spambag is about to set up on which Costa Rica ISP, who's just agreed to provide haven for whom, etc. That's what it's all about," he wrote. Linford concluded with a plea for spam fighters to give Spews a chance to correct any systemic flaws.

  Thompson decided to withhold further public judgment on Spews. But she felt Linford's message deserved a response. Despite their efforts to insulate themselves from criticism, she warned, the people behind Spews were sure to have some rocky days ahead.

  "If the Spews folks want to do this, they had better be prepared. Because...it will never, NEVER be any easier than this. It only gets harder."

  Thompson's words struck some anti-spammers merely as sour grapes. But her prediction would prove painfully true. In the years ahead, the desperate efforts by spammers to unmask Spews would eventually roil the lives of several Nanae leaders, including Shiksaa and Linford.

  But at the time, September 2001, it was Thompson's life that was about to take a dramatic new turn. No one would read about it in Nanae for months, but she had quietly started working for Mindshare Design, a California company that operated a bulk-emailing service called PostMaster General.

  When Thompson accepted the position as Mindshare's Standards and Practices Manager, she was well aware that PostMaster General was frequently abused by junk emailers and derided on Nanae as a spam foundry. She realized that many anti-spammers, had they known of her plans, would have scorned her for selling out, for crossing over to the dark side. But Thompson didn't view her decision that way. Instead, she saw herself going to fight spam from the inside.

  * * *

  [1] A transcript of the message was published at Spamhaus.org.

  [2] MAPS continued to provide free access to nearly anyone who asked, as long as the interested party agreed to sign a standard agreement shielding MAPS from legal action. Despite the change in its policies, MAPS retained many large customers and remains an influential force in the battle against spam.

  Hawke Takes on an Apprentice

  After nearly two years of nonstop spamming, Davis Hawke finally started to make some serious money in the summer of 2001. Instead of earning a couple hundred dollars per week, Hawke suddenly measured his cash flow in the thousands as he racked up orders for Power Diet Plus. And it wasn't as if he was working any harder. In fact, Hawke had discovered that business operated most smoothly when he sent out spams only from Friday evening through Sunday evening. System administrators at ISPs tended to take off weekends, so they couldn't respond to complaints about Hawke's spamming until Monday. By then, his messages were already waiting in the in-boxes of hundreds of thousands of people.

  The schedule essentially left Hawke with a five-day weekend. While the working stiffs of the world were chained to their desks, he was taking hikes in the woods with his wolf Dreighton, working on his knife-throwing technique, or polishing up his archery skills. Hawke also whiled away his time reading chess books and polishing his playing skills against online opponents through an interactive system called Internet Chess Club.

  But as Hawke watched the ever-larger deposits from his credit card processor arrive in his bank account, he got nervous. The money s
eemed too vulnerable there. One day he withdrew a couple thousand dollars in hundred-dollar bills. Using rubber bands, he tightly wrapped the stack of bills in heavy black plastic sheeting and placed them in a plastic bottle. Hawke put the bottle and a small spade in a backpack and headed on foot with Dreighton deep into Tennessee's Cherokee National Park. When Hawke located a good spot, away from any trails but near some memorable landmarks, he dug a hole and buried the bottle. It would be the first of several stashes of cash that he would refer to as his "deposits."[3]

  At the end of June, Hawke decided to go to Philadelphia for the 2001 World Open chess tournament. With Patricia staying behind to run QuikSilver, he headed out on the nine-hour drive north. To keep himself alert, he listened to books on tape, including A Brief History of Time by Stephen Hawking. Hawke had read the Cambridge University professor's book a few years before, but he still found himself mesmerized as he motored up I-81 while a British narrator read Hawking's explanation of Einstein's theory of relativity and other concepts of astrophysics.

  The tournament was held in a large hotel in the northwestern suburbs of Philly. Hawke found the conference room set aside for registration and began filling out an entry form using his Walter Smith pseudonym. As he was leaning over the table, Hawke heard a loud voice behind him.[4]

  "Britt Greenbaum? Yo, is that you Britt?"

  Hawke winced and turned around. He recognized Mauricio Ruiz, a talented chess player he hadn't seen since he left Massachusetts. Ruiz was a good looking, happy-go-lucky guy, a couple of years younger than Hawke.

  "Hey, Maury," he said cautiously.

  "What have you been up to lately, Britt? I hardly recognized you."

  Hawke shot a glance at the woman working the registration table and took a step toward Ruiz.

  "Call me Walter now, ok?"